24 matches found
CVE-2022-40000
CVE-2022-40000 corresponds to a Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1, allowing remote attackers to execute arbitrary code via the username field on the admin login page. Affected product is FeehiCMS 2.1.1; the underlying issue is an XSS flaw in the username input path, with ...
CVE-2022-40373
CVE-2022-40373 is an XSS vulnerability affecting FeehiCMS 2.1.1. The vulnerability allows remote attackers to upload a crafted XML file to execute arbitrary code. Connected documents corroborate the same vector and affected version, but do not provide detailed root-cause analysis, exploit steps, ...
CVE-2022-43320
CVE-2022-43320 affects FeehiCMS v2.1.1 and is a reflected cross-site scripting (XSS) flaw exploitable via the id parameter in /web/admin/index.php?r=log/view-layer. The issue is documented across multiple feeds as a reflected XSS with no publicly provided patch/version fix in the connected source...
CVE-2020-19709
CVE-2020-19709 affects feehicms 0.1.3 (PHP-based CMS). The root cause is insufficient filtering of the tag parameter, enabling cross-site scripting that allows attackers to execute arbitrary web pages or HTML via a crafted payload. The connected documents describe XSS in feehicms but do not speci...
CVE-2020-20589
The connected documents confirm CVE-2020-20589 affects FeehiCMS 2.0.8 with a Cross-Site Scripting (XSS) flaw in the lang attribute of HTML tags. The vulnerability enables remote attackers to deliver and execute malicious scripts in the victim’s browser (client-side impact). No official patch/vers...
CVE-2022-40002
FeehiCMS 2.1.1 is affected. The vulnerability allows an attacker to execute arbitrary scripts via the callback parameter to the /cms/notify API, leading to XSS and potential browser-based actions. Root cause: unvalidated callback handling in the notify endpoint. Affected component: FeehiCMS-2.1.1...
CVE-2021-36573
CVE-2021-36573 refers to a file-upload vulnerability in Feehi CMS up to version 2.1.1, allowing an attacker to execute arbitrary code via a crafted image upload. The root cause is an unrestricted/unsafe image upload handling that enables code execution on the server. Public references in the conn...
CVE-2022-40001
CVE-2022-40001 affects FeehiCMS 2.1.1. The vulnerability is a reflected/stored Cross Site Scripting (XSS) in which an attacker can cause the application to execute arbitrary code through the title field on the create article page. Exploitation details are not elaborated beyond this vector in the ...
CVE-2020-36607
Observed vulnerability: FeehiCMS 2.0.8 has a Cross Site Scripting (XSS) flaw that lets remote attackers execute arbitrary code via the lang attribute of an HTML tag. The issue is documented across multiple sources; one mixture of advisories confirms the affected version and nature of the flaw. Ro...
CVE-2021-36572
CVE-2021-36572 affects Feehi CMS up to version 2.1.1, where the login page’s username field is vulnerable to reflected/stored cross‑site scripting that enables an attacker to run arbitrary code. The vulnerability is triggered through the user name field of the /login endpoint, as noted in multipl...
CVE-2022-40408
FeehiCMS v2.1.1 is affected by CVE-2022-40408, a cross-site scripting (XSS) vulnerability that can be triggered by a crafted payload entered into the Comment box of the Single Page module. The issue is explicitly described across multiple sources as an XSS in this area; CVSS base score is 5.4 (Me...
CVE-2020-21322
CVE-2020-21322 is an arbitrary file upload vulnerability in Feehi CMS v2.0.8 and earlier that allows an attacker to execute arbitrary PHP code via a crafted file. Affected: Feehi CMS (PHP-based). Root cause: improper handling of uploaded files enabling code execution. Impact: remote code executio...
CVE-2022-4014
FeehiCMS exposes a CSRF vulnerability in the Post My Comment Tab component (CVE-2022-4014). The issue affects FeehiCMS and can be exploited remotely via an unknown functionality of the Post My Comment Tab, per multiple sources. The CVE entry notes cross-site request forgery with a CVSS v3.1 base ...
CVE-2024-8296
FeehiCMS up to version 2.1.1 is affected by a vulnerability in the insert function (/admin/index.php?r=user%2Fcreate) where manipulating User[avatar] enables unrestricted file upload. The issue can be triggered remotely and, per the sources, the exploit has been disclosed publicly. Vendor has rep...
CVE-2020-21516
FeehiCMS 2.0.8 contains an arbitrary file upload vulnerability in the head image/avatar upload pathway, enabling attackers to execute PHP code on the server. The issue is documented across multiple sources (including Red Hat, Veracode, GHSA, OSV, and NVD) with CVSS v3.1 base score 9.8 (CRITICAL, ...
CVE-2020-21174
CVE-2020-21174 affects liufee CMS v2.0.7.1. The vulnerability is a file-upload flaw in the image suffix function that allows a remote attacker to execute arbitrary code. Root cause is a lack of validation in the image suffix handling. Impact is high (remote code execution) per CVSS 3.1/9.8, but t...
CVE-2020-21489
CVE-2020-21489 affects FeehiCMS v2.0.8, describing an arbitrary file upload vulnerability that enables a remote attacker to execute code via the /admin/index.php?r=admin-user%2Fupdate-self component. Multiple sources (NVD, Red Hat, CNVD, OSV, GHSA, CNNVD) reiterate the same vulnerability with a h...
CVE-2024-8294
CVE-2024-8294 affects FeehiCMS up to version 2.1.1. The issue is an unrestricted file upload in the update function at /admin/index.php?r=friendly-link%2Fupdate, caused by unsafely handling the FriendlyLink[image] parameter. Exploitation is remote and publicly disclosed; multiple sources corrobor...
CVE-2025-63520
CVE-2025-63520 is an XSS vulnerability in FeehiCMS 2.1.1 exploitable via the id parameter in the User Update function (URL parameter ?r=user%2Fupdate). Multiple sources (NVD/Red Hat/Snyk and OSV variants) confirm a cross-site scripting flaw in this component. The Snyk report explicitly describes ...
CVE-2025-15264
CVE-2025-15264 affects FeehiCMS (up to v2.1.1) via the TimThumb component in frontend/web/timthumb.php. The vulnerability arises from manipulating the src argument, enabling server-side request forgery (SSRF) and potentially allowing remote exploitation. Public disclosures of the exploit exist; t...
CVE-2025-65657
CVE-2025-65657 affects FeehiCMS 2.1.1. A vulnerability in Ad Management allows authenticated remote attackers to upload files (e.g., crafted PHP) that the server may execute, causing remote code execution. The issue is tied to unrestricted file upload with insufficient validation. Exploitation de...
CVE-2025-63522
FeehiCMS 2.1.1 is affected in the Comments Management function by a Reverse Tabnabbing issue. Attacker-controlled or manipulated link behavior in target="_blank" could enable phishing or session-hijacking-type effects as described in connected sources. The vulnerability is rated CVSS v3.1 base sc...
CVE-2025-63523
CVE-2025-63523 : FeehiCMS 2.1.1 fails to enforce server-side immutability for parameters labeled as “read-only.” An authenticated attacker can intercept a parameter in transit, modify it, and have the backend accept the changes, potentially causing unintended username changes. The available docum...